mSecure password manager hack prompts password reset warnings
MSecure, a password manager, is telling its customers to rotate everything after an attacker got hold of an encrypted customer database. That's the scenario password manager users fear most, because the product's entire promise is that your secrets stay secret even if the vault leaks. The company hasn't said whether the encryption itself was broken, and that's the detail that matters most. If the data is truly encrypted with strong keys, offline access becomes a slow, grinding problem of brute-forcing master passwords. If not, this is a credential theft event on a large scale.
The move to have people remove passkeys is telling. Passkeys are supposed to be immune to server-side leaks, so advising users to remove them suggests the worry is about the accounts the passkeys were protecting, not the passkeys themselves. I'd want to know which data fields were in that database and whether any plaintext metadata like usernames or password hints escaped. Warning former customers as well as current ones makes sense, and it also hints the damage may have been done before anyone noticed.
The practical takeaway is unglamorous but real. A password manager is only as good as its response to a breach, and issuing resets is the baseline, not the fix. I'd want to hear the post-mortem with affected counts and encryption details before trusting the next version of the vault.